Conventional elevator installations have safety circuits which consist of safety elements connected in series. These safety elements monitor, for example, the state of shaft or car doors. Such a safety element may be a contact. An open contact shows, for example, that a door is open and a potentially impermissible door state has occurred. If an impermissible open state of the doors is now identified with the contact open, the safety circuit is interrupted. This results in a drive or brakes, which act on the travel of an elevator car, stopping the elevator car.
The patent specification WO 2009/010410 A1 discloses a monitoring device for an elevator installation having a control unit and at least one bus node and a bus. The bus enables communication between the bus nodes and the control unit. The bus node monitors, for example, the state of shaft doors using a safety element. The bus node has a first microprocessor and a second microprocessor. In this case, the first microprocessor is designed to read digital specification signals from the control unit, to convert said signals into an analog signal and to apply the latter to the safety element. The second microprocessor in turn measures the analog signal downstream of the safety element and converts said analog signal into a digital signal. The second microprocessor provides the control unit with this digital information. This information is either transmitted from the bus nodes to the control unit in the form of digital signals or is requested by the control unit by means of a query. If the safety switch is open and the second microprocessor consequently does not measure an analog signal, it spontaneously transmits an item of negative status information to the control unit.
So that safe operation of the elevator installation can be ensured, it is necessary to recurrently test the proper functionality of the two microprocessors, in particular the second microprocessor if a negative status occurs, that is to say if a safety element is open. WO 2009/010410 A1 proposes a specification signal test for this purpose. During this test, the control unit transmits different digital specification signals to the first microprocessor. The control unit can determine, on the basis of the digital signals transmitted or provided by the second microprocessor, whether the two microprocessors correctly convert the varying specification signals. A specification signal having the value of zero or an error value is a special situation in which the spontaneous response of the second microprocessor is provoked. The control unit transmits a digital specification signal having an error value to the first microprocessor, which converts said signal into an analog specification signal having an error value and applies it to the safety element. An open safety element is simulated as a result. The control unit expects the second microprocessor to spontaneously respond on the basis of the detected analog specification signal having an error value and to send a digital signal to this control unit. If these expectations of the control unit are met and the other specification signals are correctly converted, the control unit can assume that both the first microprocessor and the second microprocessor are operating properly.
A disadvantage of such testable bus nodes is their still relatively expensive production. In the mass production of these bus nodes, small cost savings already have a large price effect.